SELinux is unmanageable; just turn it off if it gets in your way

Re:SELinux is unmanageable; just turn it off if it gets in y... by mmis1000 on Wednesday April 27, 2022 @07:37AM (#31178660)

Docker actually comes with a seccomp and an apparmor config that bans many things by default. while it is absolutely not noticeable unless you are trying something like docker in docker. There are so many syscall that shouldn't even be relevant to normal programs.

[ Parent | on HN ]

Re:SELinux is unmanageable; just turn it off if it gets in y... by fefe23 on Wednesday April 27, 2022 @08:12AM (#31178926)

That's why I explicitly mention "whitelisting".

If you just want to ban some obscure syscalls and call it a day, you can do that. It will probably even be helpful to some degree.

I personally think our aspirations should be higher than "let's ban ptrace(2)".

[ Parent | on HN ]

Re:SELinux is unmanageable; just turn it off if it gets in y... by mmis1000 on Wednesday April 27, 2022 @10:37AM (#31180426)

It's actually a bit more than that. The syscall docker allowed isn't really fixed. It is affected by what linux capabilities the container had granted. Like: if you whitelist the container about CAP_SYS_PTRACE, you probably also want ptrace(2) to be whitelisted. Instead of a all or nothing/your program will still break even cap added model.

[ Parent | on HN ]